MGD
Premium,MVM
join:2002-07-31
Fort Lauderdale, FL
| reply to StillAtIt
Re: ACCEPT-ALL-PAYMENTS.COM, AL-PAY, E-SPRINT, 24-HOUR CORP
ACCEPT-ALL-PAYMENTS.COM, AL-PAY, E-SPRINT, 24-HOUR CORP 800 682-7189 800-683-6024
It has been almost six months since we have heard anything regarding the parallel AMEX fraud charges ran by Sacramento California Russian Expatriate cyber-mules. History tells us that even though we are not hearing anything, the chances that this multi year fraud operation has been abandoned, are between slim and none. Though I have routinely sniffed around looking for signs of them, unsuccessfully, that certainly did not mean they had stopped. Since fraud reports can show up in a myriad of places, it can be very difficult to monitor.
What brings the Sacramento county Russian cyber-mule operation to the forefront once again, is a recent ongoing AMEX fraud with a twist, and some publicity. The current Amex fraud charge run can be directly tied to the same long running criminal operation, and also highlights new cyber-mules. The twist is that the fraudulent AMEX merchant accounts are now processing bogus charges to both US and UK victims with AMEX affiliated cards. I hit on this by changing some of the key word combo searches that I mentioned earlier that were routine exercises.
It unfolded as follows:
First was a search that returned a TV News video report from CBS 13 News in Sacramento, CA.
quote:
Local residents Targeted By Credit Card Scam
Worldwide complaints from American Express card owners have led investigators to the Sacramento area, where a false business was allegedly making false charges. Elyce Kirchner reports: »cbs13.com/video/?id=39375@kovr.dayport.com
Well with those keywords "American Express" "Sacramento" "false business" false charges", I knew before I even watched the video where and to who this would lead to.
Sure enough, a new crop of Russian expatriate Amex cyber-mules, and one not so new. What was driving this were complaints from the USA and UK victims of fraud charges originating from:
24 HOUR CORP 800-682-7189
6104 Holt Ln.
Carmichael, CA 95608
800-682-7189
By the way, these fraud charges vary from $25 to $50 per hit.
Sample extracts follow from:
»www.complaintsboard.com/complain···7/page/1
quote:
18 days ago by Aimee
Same exact thing just happened to me- amex card, same business name, same notes, except they did it 2 times, and the charge was 44.19 each time.
--------------------------------------------------
17 days ago by Michele
Same thing. Two charges on my AX card for $37.69 each!
When you double hit in this range, then these are intended to be short lived fast burn accounts. Remember they can usually draw the money within 48 hours of submitting the charge. As long as they pile them in they can cover and keep adding to the draw, they can move the funds out fast. it is long gone by the time the victim sees the statement.
Emphasis added:
quote:
16 days ago by J. F. [send email]
I agree that I think this company is fraudulent. This is the information that I have found about the supposedly company.
I did a reverse search lookup for the company's address on whitepages.com and these are the results that I have found:
1 Result matching "6104 Holt Ln, Carmichael, CA."
Andrey Yakovlev ------------->Strike One = Russian
6104 Holt Ln
Carmichael, CA 95608-3972 ----->Strike Two = Sacramento County
phone number unavailable
Fraud charges in these amounts are what drew the national media attention to the "Pluto" and "Digital Age" card fraud. Likewise here:
quote:
9 days ago by Katie
ATTENTION ALL VICTIMS OF 24 HOUR CORP SCAM:
I work for the Better Business Bureau in North East California. We are currently working on the 24 Hour Corp Scam with AMEX card holders. This scam has reached all the way to the UK.
PLEASE EMAIL ME at your earliest convenience. We are meeting with channel 3 and 13 and would love to schedule more interviews and find out more information as to the number of people affected.
I look forward to hearing from you. Thanks,
Sincerely,
Katie Robison
Public Relations and Program Services
katier[@]necal.bbb.org
Several, but not all, of the UK victims had visited the USA:
quote:
14 days ago by Nigel Barber
I went to the States in May and only spent money at the hotel on my credit card and got US Dollars before I went.
I have been back for nearly 4 months and now I get a 24hour corp on my statement for 23.18$.
I have phoned my bank and they are aware of it and now they are investigating. Ihave given them the address above and we shall see what happens. This really is annoying.
More on why AMEX could should have prevented this, they have known about this fraud group for several years. This is not "new" to American Express, at all.
quote:
7 days ago by Janice
I am based in the UK and noticed the unauthorised charges because they were the only ones in US Dollars on my statement. I hadn't used my card abroad or over the internet.
Amex (in the UK) said that they are aware of the problem and their fraud team are investigating. They have stopped my card and will credit me for the two unauthorised charges which were $28.04 each.
Many thanks for posting the alerts. Without it, I would not have known I was a victim of fraud.
Can you believe this bank !!!
This is asinine!:
quote:
13 days ago by Clare Gomme
Each month for the last 3 months, I have had charges on my Lloyds card to this company. I have tried to cancel the card to prevent this fraudulent use but Lloyds inform me that, even though they are investigating this company on behalf of a large number of clients, my account cannot be closed until the investigation is complete. In the mean time I am having to phone up each month to dispute this charge. This month I have also been charged for late payment with interest for the disputed amounts on my current statement. To make matters worse I have never used the Amex card on this duo card account so how has 24 hour corp got hold on my account number. Could the fraudster must be an employee of Lloyds?
And it is not just that thread, this one too:
24 hour corp and/or e-sprint LLC
800 682-7189 and 800-683-6024
accept-all-payments.com
»www.complaintsboard.com/complain···057.html
quote:
28 days ago by Pl
AMEX (from MBNA) in the UK recognised this as fraud & cancelled the card - it is said that the amounts are low because its below the authorisation limit so they go through automatically - but some AMEX issuers are waiting for customers to complain before they do anything.
Spreading to other countries:
quote:
27 days ago by George
I had two charges from them on my Greek Alpha Bank AMEX, within July, the amounts were 17, 05 and 17, 18 euros...it is amazing the way they let this company charging people all this time. The Bank returned the amounts but I still find it unacceptable...
I have reported it since 4 of AUGUST and AMEX still let them charge.
A UK victim's thread on the UK forums Moneysavingsexpert.com:
»forums.moneysavingexpert.com/sho···1&page=2
quote:
Lloyds TSB Credit Card
------------------------
Beware, its seems that some thing suspicious is happening with transactions with Lloyds TSB cards.
LLoyds TSB have said they have had alot of the same, but they dont know who the company is.
It showed on some statements as
24 HOUR CORP 24hour CARMICHAEL CA£18.340806 35.37 USD @ 1.9286
24 HOUR CORP 24hour CARMICHAEL CA £19.54
##0805 37.69 USD @ 1.9289
So make sure you check your statements!!
-------------------------------------------------------
I have had a charge on my Virgin Amex for approx $23 which translates at £13.84 from 24 Hour Corp Carmichael. Virgin have said they will contact the merchant and ask for documentation. They give them 40 days for a response and if it's not a legitimate charge they will refund the money back to my account. In the meantime the amount is frozen so it doesn't accrue interest but they won't issue me with a new card until it is confirmed as a fraudulent transaction.
This is a known fraud
------------------------------------------------------
A similar charge has appeared on my British Airways Blue Amex card. $44.92 USD on 10 Aug 08.
I am just off the phone to Amex and I was told that this is a known fraud which is impacting numerous cardholders. They will refund it and they have insisted that my card is cancelled and a replacement issued.
What dissapoints me is that their fraud team are aware of this and they are not proactively identifying customers that are impacted. When I pushed them on this I was told: "It would take too long to review every account, so we are waiting for customers to call us - Amex have revoked the merchant's Amex authorisation, but because the transactions are below the "floor limit" they are applied automatically to customer accounts without being checked to see if they are valid".
Please keep your eyes open!!!
What is even more disappointing is the fact that American Express has known about this specific fraud operation for several years. Contributing to the problem is how easy Amex doles out merchant accounts. Since a core function of this long running fraud is the use of Russian expatriate cyber-mules from a concentrated area around Sacramento County, a simple add on in the vetting process that was listed in the above post, could easily filter these out at application time.
So lets look over some of the info that has already been posted, and add some to it:
ACCEPT-ALL-PAYMENTS.COM, AL-PAY, E-SPRINT, 24-HOUR CORP 800 682-7189 800-683-6024
The website ACCEPT-ALL-PAYMENTS.COM is now down, two cached pages still exist from August 26th 2008:
from the page:
Contact Us
E-Sprint LLC,.
2721 Rio Linda blvd. Sacramento, CA, 95815
Phone/fax +1(800)683-6024
So, did American Express improve the vetting process for individual merchant accounts, and the criminals moved up to the next rung on the ladder and were operating as a secondary wholesaler / affiliate?:
quote:
Welcome to AL-Pay! The best credit card and E-check payment system on the net.
Did you know that when you accept credit cards and checks online, you can expect your sales to increase by an astounding 50 to 400%? You simply can't compete if you don't accept credit cards and e-check. With our free online application, you can start accepting credit cards and e-checks on your web site in less than 24 hours! In addition to accepting credit cards and e-checks on your web site in real-time, you will also receive our simple-to-use, web-based payaments administration system. With our versatile ecommerce software, you have a complete solution.
Or was that just a ruse?
Running down the names:
E SPRINT is a California LLC registered on March 11th 2008 by a PAVEL UDALOV:
LP/LLC
E SPRINT LLC
Number: 200807110216
Date Filed: 3/11/2008 Status: active
Jurisdiction: CALIFORNIA
.
Address
2721 RIO LINDA BLVD
SACRAMENTO, CA 95838
.
Agent for Service of Process
PAVEL UDALOV
2721 RIO LINDA BLVD
SACRAMENTO, CA 95838
There was also a matching Sacrament Country Fictitious Business Registration for E SPRINT LLC:
There is no phone listing for either PAVEL UDALOV or a reverse for that address. In fact, there is no public records for a Pavel Udalov within the entire state of California. That home however does show up as having being last purchased on 08/07/2007 and was put back on the market a month later. That home was recently listed on "Sacramento Area Flippers In Trouble", as having a 37% drop in asking price from the previous sale, and has unpaid back property taxes for 2007.
»74.125.45.104/search?q=cache:DEd···=5&gl=us The address is no longer on the MLS listing.
I am unable to find anything specific for "Al-Pay". However, the ACCEPT-ALL-PAYMENTS.COM domain as "StillAtIt" posted, brings us to a very familiar name:
Registered through: GoDaddy.com, Inc
.
Whois Record
Registrant:
ESprint Corp.
4351 marysville blvd
Sacramento, California 95838
United States
.
Domain Name: ACCEPT-ALL-PAYMENTS.COM
Created on: 27-Apr-08
Expires on: 27-Apr-09
Last Updated on: 27-Apr-08
.
Administrative Contact:
piglitsin, roman piglitsin@hushmail.com
ESprint Corp.
4351 marysville blvd
Sacramento, California 95838
United States
(916) 308-7086 Fax --
.
Domain servers in listed order:
NS13.DOMAINCONTROL.COM
NS14.DOMAINCONTROL.COM
From February 2008:
quote:
Julia:
VIN design, Roman Piglitsin and Solomka from Sacramento and Plumas, CA have hit my Amex three times now since November for $12.38, $9.45 and $9.59. Fortunately, Amex has been good about crediting my account.
»Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto
From March 2008:
quote:
Angry:
Oh my! I did a search of some bogus charges that were on my AMEX and this site popped up! Thank goodness I'm not alone. I apologize in advance if this is not the correct place to post this or if you all have discussed this information previously.
The two companies that charged my AMEX have already been posted by others:
1) ROMAN I PIGLITSIN Telecom Service 2/20/08, $11.87
ROMAN I PIGLITSIN DBA
4351 Marysville Blvd
Sacramento, CA 95838
Cellular Telephones
R And P Web Designer
2) SOLOMKA DESIGN, Computer network 2/08/08 $11.95
SOLOMKA Design
4282 Pinell St Ste 101
Sacramento, CA 95838
Internet Downloads
I immediately flagged it online, but didn't submit it as a fradulent charge. At the time I thought it MIGHT have been something connected to my MONTHLY charge from EXPERIAN that is SUPPOSED to cover credit report monitoring and protection. Imagine that! ....
..
AMEX has sinced given me a credit and sent letters stating they are investigating.
»Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto
That ties ROMAN I PIGLITSIN to SOLOMKA, which ties to VALLJRSX VALL-JRSX »Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto and also to Mobil Txt, and on up the ladder we go!.
Roman's directory listing does show him as the owner of "R And P Web Designer",
which means that the White Pages picked it up from a business filing, a search of both Sacramento County, and California records does not yield a hit. It is possible that it could be registered in another county.
These are the only two listings:
Did the crime syndicate do the same as they do in the other divisions, and after the ROMAN I PIGLITSIN DBA cyber-mule merchant account burned up, and he became black listed, then used his identity to register the ACCEPT-ALL-PAYMENTS.COM domain?
The last several months have been a dry spell in terms of fraud charge information on this Amex division, though I doubt that they were on vacation. In fact Domain Tools shows that there are a total of 6 domains registered using the piglitsin@hushmail.com email address.
One of them as late as July. You should presume the other 5 are also tied to fraudulent American Express merchant accounts that we do not know about. Some of them may have been already active, I have searched for fraud reports.
That brings us to 24-HOUR CORP, there were three Corporate registrations of that name:
The first one was in the beginning of 2005, and subsequently suspended:
Corporation
24 HOUR CORP.
Number: C2715247
Date Filed: 1/10/2005
Status: suspended
Jurisdiction: California
.
Address
6104 HOLT LANE
CARMICHAEL, CA 95608
.
Agent for Service of Process
LEO YAKOVLEV
6104 HOLT LANE
CARMICHAEL, CA 95608
Then registered again on 08/18/2006 with a new address:
Corporation
24 HOUR CORP.
Number: C2892866
Date Filed: 8/18/2006
Status: suspended
Jurisdiction: California
.
Address
2370 MARKET ST STE 111
SAN FRANCISCO, CA 94114
.
Agent for Service of Process
LEO YAKOVLEV
2370 MARKET ST STE 111
SAN FRANCISCO, CA 94114
Registered for a third time in June of 2008, new agent name, but the same address as the 2006 registration:
Corporation
24 HOUR CORP
Number: C3150801
Date Filed: 6/23/2008
Status: active
Jurisdiction: California
.
Address
2370 MARKET ST STE 111
SAN FRANCISCO, CA 94114
.
Agent for Service of Process
DAVID BLESS
2370 MARKET ST STE 111
SAN FRANCISCO, CA 94114
.
The 2370 MARKET ST STE 111 address is the same as that of a company called Ferro Rosso Corp. www.ferro-rosso.com »www.ferro-rosso.com
Yelena Milovanova
2370 Market Street, Suite 111
San Francisco, CA 94114
888-870-7797
Ferro Rosso Corp.
2370 Market Street, Suite 111
San Francisco, CA 94114
What the connection is to this apparently legit company, I do not know. However, they have more than an address in common:
They share the same "24 Hour Corp" as the agent, which in 2007 would have been LEO YAKOVLEV. A check of all FBNs' registered to either Andrey or Leo:
With so little information thus far, I do not necessarily suspect a formal conspiracy between the criminals and the cyber-mules, because of the common Russian heritage link. Evidence of hiding, or otherwise participating in the obfuscation of the set ups would indicate some level of complicity.
However, what has been frustrating, is the inability to obtain information from known cyber-mules. Their unwillingness to even talk about it, or cooperate, certainly leaves an impression of being complicit, which may or may not be accurate. Repeated contact attempts yields mules who claim to be only able to speak Russian. When you hear others speaking English in the background, and point that out, they still refuse to have them act as translators. They do know the subject matter, and most of the calls end abruptly. In a case where a translator was available and the issue was discussed with them, they offered to call back with the cyber-mule present, but never did. Repeated follow up calls were ignored. That makes the Sacramento case a difficult area to crack and gather intelligence data on. Based on this stonewalling, which may be more cultural that anything else, a Dslr member who spends time in that area attempted several months ago to generate local media interest in the case, and was not successful.
How complicit some of these cyber-mules are may be revealed in the upcoming Federal case of the 2005 cyber-mule, ALEX BERNIK of LEXBAY LIMITED ROSEVILLE CA: »Re: VALL-JRSX, VIN-DESIGN, E NAT, PARADISE WEB
MGD |
